CTI STIX SC Status Report October 22, 2015

The State of the Subcommittee is Good n 61 members / 6 observers n 3 active workproducts l STIX v1.2.1 language specifications l XML binding specification for STIX v1.2.1 l STIX v2.0 language specifications n Many active discussions on specific issues around the language n Many active strategic discussions l Serialization decisions (e.g., MTI) l Formal modeling approaches

STIX specification status and next steps n Multipart specification for the STIX language n STIX SC approved drafts n Draft specification package uploaded to CTI TC site – 10/15/15 n Awaiting TC motion and vote to move to Committee Specification for Pubic Review Draft n STIX Version Part 1: Overview. n STIX Version Part 2: Common. n STIX Version Part 3: Core. n STIX Version Part 4: Indicator. n STIX Version Part 5: TTP. n STIX Version Part 6: Incident. n STIX Version Part 7: Threat Actor. n STIX Version Part 8: Campaign. n STIX Version Part 9: Course of Action. n STIX Version Part 10: Exploit Target. n STIX Version Part 11: Report. n STIX Version Part 12: Extensions. n STIX Version Part 13: Data Marking. n STIX Version Part 14: Vocabularies. n STIX Version Part 15: UML Model. n Uml Model Serialization n XMI files n Diagrams

XML binding specification for STIX v1.2.1 n Consists of : l Textual specification document characterizing mapping rules to generate an XML Schema serialization from the STIX v1.2.1 language UML model l XML Schema reference implementation for STIX v1.2.1 n Status l Drafts are currently in authoring/editing process l Targeted for STIX SC review in November

STIX v2.0 specification status n Official kickoff was yesterday (10/21/15) n Currently selecting editors n Initiating deliberative process l Identifying and fleshing out use cases l Triage of issue trackers n Looking into options for issue “voting” l Plan to flesh out use cases iteratively while tackling issues l Plan to immediately begin discussing 2-3 high priority issues identified from list discussions

Active Discussion: Serialization Decisions n To date, only specified serialization has been XSD n What implementation serialization(s) is most appropriate? n Should we support multiple serializations? Which ones? n Strong consensus on the idea of specifying a Mandatory to Implement (MTI) serialization n Not yet enough information (still defining selection criteria and unknowns with how STIX will change in 2.0) to decide on MTI l Looks like current preference is leaning strongly to JSON

Active Discussion: Formal Modeling Approaches n Current STIX approach: formal UML structural model with textual explanation of semantics and manual serialization binding(s) n Proposed STIX approach: formal UML conceptual model (including explicit semantics) with auto-derived formal semantic serialization model (RDF/OWL) with subsequently auto-derived (tuned) implementation serialization(s) (JSON-LD, RDF/XML, etc)

Active Discussion: Formal Modeling Approaches n Potential advantages l Model specifies language semantics explicitly l Supports richer analysis approaches l Assurance of serialization mapping accuracy (full traceability and lossless translation) l Ease of integration with other relevant cyber ontologies n Potential questions/concerns l CTI TC community mostly unfamiliar with approach l Ease of use for implementers wanting simple serialization l Capabilities of default serializations like JSON-LD l Feasibility of available tooling